claude-dev-env 8.68.4 → 8.69.1

package/hooks/blocking/test_pr_lifecycle_skill_gate.py

@@ -14,7 +14,7 @@ if str(HOOKS_DIRECTORY) not in sys.path:
 from blocking import followup_pr_dedupe as gate_dedupe
 from blocking import pr_lifecycle_skill_gate as gate
 from hooks_constants.pr_lifecycle_skill_gate_constants import DENY_REASON
-from hooks_constants.pull_request_proof_constants import MISSING_PROOF_REASON
+from hooks_constants.pull_request_proof_constants import MISSING_BUILD_EVAL_REASON, MISSING_PROOF_REASON
 
 PROVEN_FOLLOWUP_BODY = (
     "Follow-up to #1731\n\n## Existing work\nNothing found in open or merged pull requests.\n\n"
@@ -225,11 +225,11 @@ def test_hook_has_its_own_pre_tool_use_registration() -> None:
         each_group
         for each_group in all_groups
         if each_group["matcher"]
-        == "Bash|PowerShell|mcp__.*__(create_pull_request|merge_pull_request|enable_pr_auto_merge|update_pull_request)"
+        == "Bash|PowerShell|mcp__.*__(create_pull_request|merge_pull_request|enable_pr_auto_merge|update_pull_request|actions_run_trigger)"
     ]
     assert matching_groups == [
         {
-            "matcher": "Bash|PowerShell|mcp__.*__(create_pull_request|merge_pull_request|enable_pr_auto_merge|update_pull_request)",
+            "matcher": "Bash|PowerShell|mcp__.*__(create_pull_request|merge_pull_request|enable_pr_auto_merge|update_pull_request|actions_run_trigger)",
             "hooks": [
                 {
                     "type": "command",
@@ -283,3 +283,117 @@ def test_loaded_skill_still_denies_a_new_pull_request_without_proof(tmp_path: Pa
     exit_code, output = _run_main(_payload("gh pr create --body 'Adds a gate.'", _transcript(tmp_path, "pr-lifecycle")))
     assert exit_code == 0
     assert json.loads(output)["hookSpecificOutput"]["permissionDecisionReason"] == MISSING_PROOF_REASON
+
+
+EVALUATED_BODY = (
+    "## Existing work\nNothing found in open or merged pull requests.\n\n"
+    "## Proof in practice\nRan `python probe.py`.\n\n"
+    "## Eval\nTen labeled cases, exact-match grader. Ran `python eval.py`: 10/10.\n"
+)
+SKILL_LOAD_LINE = json.dumps(
+    {"type": "assistant", "message": {"content": [{"type": "tool_use", "name": "Skill", "input": {"skill": "pr-lifecycle"}}]}}
+)
+BUILD_EVAL_LINE = json.dumps(
+    {
+        "type": "assistant",
+        "message": {
+            "content": [{"type": "tool_use", "name": "Skill", "input": {"skill": "claude-api", "args": "build-eval"}}]
+        },
+    }
+)
+
+
+def _transcript_with_lines(tmp_path: Path, file_name: str, all_lines: list[str]) -> Path:
+    transcript_path = tmp_path / file_name
+    transcript_path.write_text("\n".join(all_lines) + "\n", encoding="utf-8")
+    return transcript_path
+
+
+def _create_payload(tmp_path: Path, title: str, transcript_path: Path) -> dict[str, object]:
+    return {
+        "tool_name": "mcp__github__create_pull_request",
+        "tool_input": {"owner": "o", "repo": "r", "title": title, "body": EVALUATED_BODY},
+        "transcript_path": str(transcript_path),
+        "cwd": _checkout_without_visible_changes(tmp_path),
+    }
+
+
+def _assert_denied_with(payload: dict[str, object], reason: str) -> None:
+    decision = gate.decision_for(payload)
+    assert decision is not None
+    assert decision["hookSpecificOutput"]["permissionDecision"] == "deny"
+    assert decision["hookSpecificOutput"]["permissionDecisionReason"] == reason
+
+
+def test_feature_pull_request_without_build_eval_invocation_should_be_denied(tmp_path: Path) -> None:
+    transcript_path = _transcript_with_lines(tmp_path, "session.jsonl", [SKILL_LOAD_LINE])
+    _assert_denied_with(_create_payload(tmp_path, "feat: add a gate", transcript_path), MISSING_BUILD_EVAL_REASON)
+
+
+def test_feature_pull_request_with_build_eval_invocation_should_pass(tmp_path: Path) -> None:
+    transcript_path = _transcript_with_lines(tmp_path, "session.jsonl", [BUILD_EVAL_LINE, SKILL_LOAD_LINE])
+    assert gate.decision_for(_create_payload(tmp_path, "feat: add a gate", transcript_path)) is None
+
+
+def test_non_feature_pull_request_without_build_eval_invocation_should_pass(tmp_path: Path) -> None:
+    transcript_path = _transcript_with_lines(tmp_path, "session.jsonl", [SKILL_LOAD_LINE])
+    assert gate.decision_for(_create_payload(tmp_path, "fix: repair a gate", transcript_path)) is None
+
+
+def test_feature_pull_request_with_no_readable_transcript_should_pass(tmp_path: Path) -> None:
+    payload = _create_payload(tmp_path, "feat: add a gate", tmp_path / "missing.jsonl")
+    assert gate.decision_for(payload) is None
+
+
+def test_build_eval_check_should_ignore_an_unreadable_transcript_beside_a_readable_one(tmp_path: Path) -> None:
+    transcript_path = _transcript_with_lines(tmp_path, "session.jsonl", [SKILL_LOAD_LINE])
+    payload = _create_payload(tmp_path, "feat: add a gate", transcript_path)
+    payload["agent_transcript_path"] = str(tmp_path / "missing-agent.jsonl")
+    _assert_denied_with(payload, MISSING_BUILD_EVAL_REASON)
+
+
+def test_build_eval_invocation_in_the_agent_transcript_should_pass(tmp_path: Path) -> None:
+    session_path = _transcript_with_lines(tmp_path, "session.jsonl", [SKILL_LOAD_LINE])
+    agent_path = _transcript_with_lines(tmp_path, "agent.jsonl", [BUILD_EVAL_LINE])
+    payload = _create_payload(tmp_path, "feat: add a gate", session_path)
+    payload["agent_transcript_path"] = str(agent_path)
+    assert gate.decision_for(payload) is None
+
+
+def _dispatch_payload(tmp_path: Path, all_inputs: dict[str, object], transcript_path: Path) -> dict[str, object]:
+    return {
+        "tool_name": "mcp__github__actions_run_trigger",
+        "tool_input": {
+            "method": "run_workflow",
+            "owner": "o",
+            "repo": "r",
+            "workflow_id": "open.yml",
+            "ref": "main",
+            "inputs": all_inputs,
+        },
+        "transcript_path": str(transcript_path),
+        "cwd": _checkout_without_visible_changes(tmp_path),
+    }
+
+
+def test_feature_dispatch_without_build_eval_invocation_should_be_denied(tmp_path: Path) -> None:
+    transcript_path = _transcript_with_lines(tmp_path, "session.jsonl", [SKILL_LOAD_LINE])
+    all_inputs = {"head": "main", "title": "feat: add a gate", "body": EVALUATED_BODY}
+    _assert_denied_with(_dispatch_payload(tmp_path, all_inputs, transcript_path), MISSING_BUILD_EVAL_REASON)
+
+
+def test_feature_dispatch_with_build_eval_invocation_should_pass(tmp_path: Path) -> None:
+    transcript_path = _transcript_with_lines(tmp_path, "session.jsonl", [BUILD_EVAL_LINE, SKILL_LOAD_LINE])
+    all_inputs = {"head": "main", "title": "feat: add a gate", "body": EVALUATED_BODY}
+    assert gate.decision_for(_dispatch_payload(tmp_path, all_inputs, transcript_path)) is None
+
+
+def test_pull_request_dispatch_without_the_skill_loaded_should_be_denied(tmp_path: Path) -> None:
+    transcript_path = _transcript_with_lines(tmp_path, "session.jsonl", [BUILD_EVAL_LINE])
+    all_inputs = {"head": "main", "title": "fix: repair a gate", "body": EVALUATED_BODY}
+    _assert_denied_with(_dispatch_payload(tmp_path, all_inputs, transcript_path), DENY_REASON)
+
+
+def test_dispatch_that_opens_no_pull_request_should_pass_without_the_skill(tmp_path: Path) -> None:
+    transcript_path = _transcript_with_lines(tmp_path, "session.jsonl", [BUILD_EVAL_LINE])
+    assert gate.decision_for(_dispatch_payload(tmp_path, {"work_order": "wo-1"}, transcript_path)) is None

package/hooks/blocking/test_pre_tool_use_dispatcher.py

@@ -724,10 +724,7 @@ def test_folded_write_edit_hooks_have_no_standalone_hooks_json_entry() -> None:
         for each_group in hooks_configuration["hooks"]["PreToolUse"]
         for each_hook in each_group["hooks"]
     ]
-    folded_script_relative_paths = (
-        "advisory/refactor_guard.py",
-        "advisory/migration_safety_advisor.py",
-    )
+    folded_script_relative_paths = ("advisory/migration_safety_advisor.py",)
     for each_script_path in folded_script_relative_paths:
         matching_commands = [
             each_command
@@ -808,7 +805,6 @@ def test_dispatcher_allows_clean_apply_patch_add(tmp_path: Path) -> None:
 
 
 ALL_RETAINED_PATHS = {
-    "advisory/refactor_guard.py",
     "advisory/migration_safety_advisor.py",
 }
 ALL_RETIRED_PATHS = {

package/hooks/blocking/test_pull_request_proof.py

@@ -1,4 +1,4 @@
-"""Behavior tests for the proof-in-practice and existing-work checks on a new pull request."""
+"""Behavior tests for the proof-in-practice, existing-work and eval checks on a new pull request."""
 
 import subprocess
 import sys
@@ -11,6 +11,7 @@ if str(HOOKS_DIRECTORY) not in sys.path:
 from blocking import pull_request_proof as gate
 from hooks_constants.pull_request_proof_constants import (
     MISSING_BODY_REASON,
+    MISSING_EVAL_SECTION_REASON,
     MISSING_EXISTING_WORK_REASON,
     MISSING_PROOF_REASON,
     UNREADABLE_CHANGES_REASON,
@@ -210,3 +211,125 @@ def test_should_read_the_head_flag_of_a_shell_create(tmp_path: Path) -> None:
     reason = gate.missing_look_reason(payload)
     assert reason is not None
     assert "page.html" in reason
+
+
+EVALUATED_BODY = SEARCHED_BODY + "\n## Eval\nTen labeled cases, exact-match grader. Ran `python eval.py`: 10/10.\n"
+EVAL_WITHOUT_COMMAND_BODY = SEARCHED_BODY + "\n## Eval\nTen labeled cases, all pass.\n"
+
+
+def _titled_mcp_create(title: object, body: object) -> dict[str, object]:
+    payload = _mcp_create(body)
+    payload["tool_input"]["title"] = title
+    return payload
+
+
+def test_feature_mcp_create_without_an_eval_section_should_be_denied() -> None:
+    payload = _titled_mcp_create("feat: add a gate", SEARCHED_BODY)
+    assert gate.missing_eval_section_reason(payload) == MISSING_EVAL_SECTION_REASON
+
+
+def test_feature_mcp_create_with_an_eval_section_naming_a_command_should_pass() -> None:
+    assert gate.missing_eval_section_reason(_titled_mcp_create("feat: add a gate", EVALUATED_BODY)) is None
+
+
+def test_feature_mcp_create_with_an_eval_heading_and_no_backtick_should_be_denied() -> None:
+    payload = _titled_mcp_create("feat: add a gate", EVAL_WITHOUT_COMMAND_BODY)
+    assert gate.missing_eval_section_reason(payload) == MISSING_EVAL_SECTION_REASON
+
+
+def test_eval_section_should_stop_at_a_heading_of_the_same_level() -> None:
+    body = SEARCHED_BODY + "\n## Evals\nCases listed.\n\n## Notes\nRan `python eval.py`.\n"
+    payload = _titled_mcp_create("feat: add a gate", body)
+    assert gate.missing_eval_section_reason(payload) == MISSING_EVAL_SECTION_REASON
+
+
+def test_fix_and_docs_titles_without_an_eval_section_should_pass() -> None:
+    for each_title in ("fix: repair a gate", "docs: describe a gate"):
+        payload = _titled_mcp_create(each_title, SEARCHED_BODY)
+        assert gate.missing_eval_section_reason(payload) is None, each_title
+        assert not gate.is_feature_pull_request(payload), each_title
+
+
+def test_feature_titles_should_count_as_features() -> None:
+    for each_title in ("feat: x", "feat(hooks)!: x", "FEAT: x", "FEAT(x)!: y", "  feat!: x"):
+        assert gate.is_feature_pull_request(_titled_mcp_create(each_title, SEARCHED_BODY)), each_title
+
+
+def test_non_feature_titles_should_not_count_as_features() -> None:
+    for each_title in ("featured: x", "feature: x", "chore: feat: x", None, 7):
+        assert not gate.is_feature_pull_request(_titled_mcp_create(each_title, SEARCHED_BODY)), each_title
+
+
+def test_gh_create_title_flag_should_be_read(tmp_path: Path) -> None:
+    (tmp_path / "b.md").write_text(SEARCHED_BODY, encoding="utf-8")
+    payload = _shell('gh pr create --title "feat: x" --body-file b.md', tmp_path)
+    assert gate.is_feature_pull_request(payload)
+    assert gate.missing_eval_section_reason(payload) == MISSING_EVAL_SECTION_REASON
+
+
+def test_gh_create_title_assignment_should_be_read(tmp_path: Path) -> None:
+    (tmp_path / "b.md").write_text(EVALUATED_BODY, encoding="utf-8")
+    payload = _shell("gh pr create --title=feat:x --body-file b.md", tmp_path)
+    assert gate.is_feature_pull_request(payload)
+    assert gate.missing_eval_section_reason(payload) is None
+
+
+def test_pull_request_script_create_title_should_be_read(tmp_path: Path) -> None:
+    (tmp_path / "b.md").write_text(SEARCHED_BODY, encoding="utf-8")
+    payload = _shell(
+        'python pull_request.py create --title "feat(x): y" --body-file b.md --repo o/r', tmp_path
+    )
+    assert gate.is_feature_pull_request(payload)
+    assert gate.missing_eval_section_reason(payload) == MISSING_EVAL_SECTION_REASON
+
+
+def test_gh_create_without_a_title_should_not_count_as_a_feature(tmp_path: Path) -> None:
+    (tmp_path / "b.md").write_text(SEARCHED_BODY, encoding="utf-8")
+    payload = _shell("gh pr create --body-file b.md", tmp_path)
+    assert not gate.is_feature_pull_request(payload)
+    assert gate.missing_eval_section_reason(payload) is None
+
+
+def test_feature_create_with_an_unreadable_body_should_leave_the_deny_to_the_proof_check() -> None:
+    payload = _shell('gh pr create --title "feat: x" --fill')
+    assert gate.missing_eval_section_reason(payload) is None
+    assert gate.missing_proof_reason(payload) == MISSING_BODY_REASON
+
+
+def _dispatch(all_inputs: dict[str, object], method: str = "run_workflow") -> dict[str, object]:
+    return {
+        "tool_name": "mcp__github__actions_run_trigger",
+        "tool_input": {
+            "method": method,
+            "owner": "o",
+            "repo": "r",
+            "workflow_id": "open.yml",
+            "ref": "main",
+            "inputs": all_inputs,
+        },
+    }
+
+
+def test_pull_request_dispatch_without_proof_should_be_denied() -> None:
+    payload = _dispatch({"head": "feature", "title": "fix: y", "body": UNPROVEN_BODY})
+    assert gate.missing_proof_reason(payload) == MISSING_PROOF_REASON
+
+
+def test_pull_request_dispatch_with_no_body_input_should_be_denied() -> None:
+    assert gate.missing_proof_reason(_dispatch({"head": "feature", "title": "fix: y"})) == MISSING_PROOF_REASON
+
+
+def test_feature_dispatch_without_an_eval_section_should_be_denied() -> None:
+    payload = _dispatch({"head": "feature", "title": "feat: x", "body": SEARCHED_BODY})
+    assert gate.is_feature_pull_request(payload)
+    assert gate.missing_eval_section_reason(payload) == MISSING_EVAL_SECTION_REASON
+
+
+def test_dispatch_that_names_no_head_or_runs_no_workflow_should_not_count_as_a_create() -> None:
+    all_payloads = [
+        _dispatch({"title": "feat: x", "body": UNPROVEN_BODY}),
+        _dispatch({"head": "feature", "title": "feat: x", "body": UNPROVEN_BODY}, "rerun_workflow_run"),
+    ]
+    for each_payload in all_payloads:
+        assert gate.missing_proof_reason(each_payload) is None
+        assert not gate.is_feature_pull_request(each_payload)

package/hooks/features/conduct-gates.md

@@ -24,7 +24,7 @@ This family stops a chat reply, edited message, or tool call when its payload br
 - `blocking/session_title_stop_gate.py` runs on `Stop`, no matcher, timeout `10` seconds in `hooks.json`.
 - `blocking/step_note_gate.py` runs on `PreToolUse`, matcher `*`, timeout `15` seconds in `hooks.json`.
 - `blocking/verify_before_acting.py` runs on `PostToolUse`, matcher `Write|Edit|MultiEdit|NotebookEdit|Agent|Task|apply_patch|Bash|PowerShell|mcp__.*`, timeout `10` seconds in `hooks.json`.
-- `blocking/pr_lifecycle_skill_gate.py` runs on `PreToolUse`, matcher `Bash|PowerShell|mcp__.*__(create_pull_request|merge_pull_request|enable_pr_auto_merge|update_pull_request)`, timeout `10` seconds in `hooks.json`.
+- `blocking/pr_lifecycle_skill_gate.py` runs on `PreToolUse`, matcher `Bash|PowerShell|mcp__.*__(create_pull_request|merge_pull_request|enable_pr_auto_merge|update_pull_request|actions_run_trigger)`, timeout `10` seconds in `hooks.json`.
 - `blocking/artifact_look_gate.py` runs on `PreToolUse`, matcher `Artifact|Skill`, timeout `10` seconds in `hooks.json`. It speaks only on an `Artifact` publish of a `.html` or `.htm` file.
 - `blocking/artifact_dark_mode_gate.py` runs on `PreToolUse`, matcher `Artifact`, timeout `60` seconds in `hooks.json`.
 

package/hooks/features/write-edit-blocking.md

@@ -1,18 +1,17 @@
 # Write and Edit blocking
 
-This family decides whether an agent's file mutation can run. It also warns about broad refactors and unsafe migration edits before the agent changes a file.
+This family decides whether an agent's file mutation can run. It also warns about unsafe migration edits before the agent changes a file.
 
 ## Checks
 
 - `blocking/pre_tool_use_dispatcher.py` combines hosted advisory output with its native description check and returns one permission decision.
-- `advisory/refactor_guard.py` warns when an Edit or MultiEdit appears to rename code beyond the current change.
 - `advisory/migration_safety_advisor.py` warns when an Edit or MultiEdit adds an unsafe Django migration operation.
 - `blocking/state_description_blocker.py` rejects historical or comparative prose in supported comments, docstrings, and Markdown.
 
 ## When it fires
 
 - `blocking/pre_tool_use_dispatcher.py` runs on `PreToolUse`, matcher `Write|Edit|MultiEdit|apply_patch`, timeout `60` seconds in `hooks.json`.
-- `advisory/refactor_guard.py` and `advisory/migration_safety_advisor.py` run inside that dispatcher on `PreToolUse`, matcher `Write|Edit|MultiEdit|apply_patch`, timeout `60` seconds. `ALL_HOSTED_HOOK_ENTRIES` selects `Edit` and `MultiEdit` for each.
+- `advisory/migration_safety_advisor.py` runs inside that dispatcher on `PreToolUse`, matcher `Write|Edit|MultiEdit|apply_patch`, timeout `60` seconds. `ALL_HOSTED_HOOK_ENTRIES` selects `Edit` and `MultiEdit` for it.
 - `blocking/state_description_blocker.py` runs through the dispatcher's native evaluator on `PreToolUse`, matcher `Write|Edit|MultiEdit|apply_patch`, timeout `60` seconds. Its evaluator checks `Write`, `Edit`, and `MultiEdit` payloads and skips `apply_patch`.
 
 ## Proving it
@@ -22,13 +21,12 @@ Preconditions:
 - Run each command from the repository root with Python and pytest available. The tests use disposable paths where they need files.
 
 - **Dispatcher decision.** Input is a clean Write payload. Run `python -m pytest packages/claude-dev-env/hooks/blocking/test_pre_tool_use_dispatcher.py -q`. The adjacent test checks that the dispatcher allows clean writes and carries denials from its checks.
-- **Refactor warning.** Input is a MultiEdit whose second edit renames a function. Run `python -m pytest packages/claude-dev-env/hooks/advisory/test_refactor_guard.py -q`. The adjacent test reports both function names in the warning.
 - **Migration warning.** Input is an Edit containing `migrations.RemoveField`. Run `python -m pytest packages/claude-dev-env/hooks/advisory/test_migration_safety_advisor.py -q`. The adjacent test observes an allow decision with a migration warning.
 - **Description gate.** Input is a Write containing historical prose in a Python comment. Run `python -m pytest packages/claude-dev-env/hooks/blocking/test_state_description_blocker.py -q`. The adjacent test observes a denial reason.
 
 ## Gotchas
 
-- `ALL_HOSTED_HOOK_ENTRIES` lists only the two nonblocking advisors. The dispatcher calls the description evaluator through its native hook table.
+- `ALL_HOSTED_HOOK_ENTRIES` lists only the nonblocking migration advisor. The dispatcher calls the description evaluator through its native hook table.
 - The dispatcher runs hosted entries in roster order. A hosted advisory crash stays silent; a native blocking check can deny the write.
 - `scripts/policy_lint/adapter_detectors.py` also loads `blocking/state_description_blocker.py`. Check that adapter when changing its evaluator.
 - `bin/install.mjs` names folded and retired script paths so reinstall can remove stale registrations.

package/hooks/hooks.json

@@ -88,7 +88,7 @@
         ]
       },
       {
-        "matcher": "Bash|PowerShell|mcp__.*__(create_pull_request|merge_pull_request|enable_pr_auto_merge|update_pull_request)",
+        "matcher": "Bash|PowerShell|mcp__.*__(create_pull_request|merge_pull_request|enable_pr_auto_merge|update_pull_request|actions_run_trigger)",
         "hooks": [
           {
             "type": "command",

package/hooks/hooks_constants/artifact_look_gate_constants.py

@@ -28,6 +28,5 @@ UNSEEN_PAGE_REASON_TEMPLATE = (
     "headless browser, for example `chromium --headless --screenshot=page.png "
     "--window-size=800,900 file://{page_path}`, then open page.png with the "
     "Read tool and check it against the ask. Fix what the picture shows, take "
-    "a new screenshot, and publish again. Attach that screenshot when you "
-    "report the page, so the person who asked sees the same proof."
+    "a new screenshot, and publish again."
 )

package/hooks/hooks_constants/followup_pr_dedupe_constants.py

@@ -17,3 +17,7 @@ DUPLICATE_FOLLOWUP_REASON_TEMPLATE = (
     " ({open_url}). Add this finding to the open follow-up pull request #{open_number}."
     " One combined follow-up pull request per parent pull request."
 )
+ALL_TITLE_OPTIONS = frozenset({"-t", "--title"})
+WORKFLOW_DISPATCH_TOOL_SUFFIX = "__actions_run_trigger"
+RUN_WORKFLOW_METHOD = "run_workflow"
+ALL_PULL_REQUEST_DISPATCH_INPUT_KEYS = ("head", "title")

package/hooks/hooks_constants/pr_lifecycle_skill_gate_constants.py

@@ -39,3 +39,6 @@ ALL_PYTHON_EXECUTABLES = frozenset({"python", "python3", "python.exe", "python3.
 PULL_REQUEST_SCRIPT_NAME = "pull_request.py"
 PATH_SEPARATOR_PATTERN = r"[\\/]"
 PYTHON_OPTIONS_WITH_VALUE = frozenset({"-X", "-W"})
+ALL_BUILD_EVAL_SKILL_NAMES = ("claude-api",)
+BUILD_EVAL_ARGUMENT_WORD = "build-eval"
+BUILD_EVAL_COMMAND_MARKER = "<command-name>/claude-api</command-name>"

package/hooks/hooks_constants/pre_tool_use_dispatcher_constants.py

@@ -83,11 +83,6 @@ class HostedHookEntry:
 
 
 ALL_HOSTED_HOOK_ENTRIES: tuple[HostedHookEntry, ...] = (
-    HostedHookEntry(
-        script_relative_path="advisory/refactor_guard.py",
-        applicable_tool_names=frozenset({EDIT_TOOL_NAME, MULTI_EDIT_TOOL_NAME}),
-        is_blocking=False,
-    ),
     HostedHookEntry(
         script_relative_path="advisory/migration_safety_advisor.py",
         applicable_tool_names=frozenset({EDIT_TOOL_NAME, MULTI_EDIT_TOOL_NAME}),

package/hooks/hooks_constants/pull_request_proof_constants.py

@@ -8,7 +8,6 @@ ALL_GH_CREATE_WORDS = ["pr", "create"]
 PULL_REQUEST_SCRIPT_NAME = "pull_request.py"
 PULL_REQUEST_SCRIPT_CREATE_WORD = "create"
 ALL_PYTHON_PROGRAM_NAMES = frozenset({"python", "python3", "py"})
-CREATE_PULL_REQUEST_TOOL_SUFFIX = "__create_pull_request"
 PROOF_GUIDE_PATH = "~/.claude/docs/rule-guides/proof-before-pull-request.md"
 MISSING_BODY_REASON = (
     "Pass the pull request body with --body or --body-file so this gate can read its"
@@ -64,3 +63,23 @@ UNREADABLE_CHANGES_REASON = (
     " from a checkout of the head branch with origin fetched, or put a screenshot"
     " link in the 'Proof in practice' section. Read " + PROOF_GUIDE_PATH + " for the full rule."
 )
+FEATURE_TITLE_PATTERN = r"^\s*feat(\([^)]*\))?!?:"
+EVAL_HEADING_PATTERN = r"^(#{1,6})[ \t]+evals?[ \t]*#*[ \t]*$"
+EVAL_GUIDE_PATH = "~/.claude/docs/rule-guides/features-start-with-an-eval.md"
+MISSING_EVAL_SECTION_REASON = (
+    "This feature pull request has no 'Eval' section naming its eval. A new feature is"
+    " built against an eval. Invoke the Skill tool with skill 'claude-api' and args"
+    " 'build-eval', build or reuse the eval it leads you to, and run it. Then add an"
+    " 'Eval' heading to the body that names the eval's cases and grader, gives the"
+    " command that runs it in backticks, and quotes its result. Read "
+    + EVAL_GUIDE_PATH
+    + " for the full rule."
+)
+MISSING_BUILD_EVAL_REASON = (
+    "This feature pull request comes from a session that never invoked /claude-api"
+    " build-eval. A new feature starts with that command. Invoke the Skill tool with"
+    " skill 'claude-api' and args 'build-eval', check the eval named in the 'Eval'"
+    " section with it, then run the same command again. Read "
+    + EVAL_GUIDE_PATH
+    + " for the full rule."
+)

package/hooks/hooks_constants/test_pre_tool_use_dispatcher_constants.py

@@ -37,21 +37,14 @@ def test_roster_keeps_only_nonblocking_edit_advisors() -> None:
     all_script_paths = tuple(
         each_entry.script_relative_path for each_entry in ALL_HOSTED_HOOK_ENTRIES
     )
-    assert all_script_paths == (
-        "advisory/refactor_guard.py",
-        "advisory/migration_safety_advisor.py",
-    )
+    assert all_script_paths == ("advisory/migration_safety_advisor.py",)
     assert all(not each_entry.is_blocking for each_entry in ALL_HOSTED_HOOK_ENTRIES)
 
 
 def test_advisors_apply_to_edit_and_multi_edit() -> None:
-    for each_script_path in (
-        "advisory/refactor_guard.py",
-        "advisory/migration_safety_advisor.py",
-    ):
-        entry = _entry_for(each_script_path)
-        assert entry is not None
-        assert entry.applicable_tool_names == frozenset({EDIT_TOOL_NAME, MULTI_EDIT_TOOL_NAME})
+    entry = _entry_for("advisory/migration_safety_advisor.py")
+    assert entry is not None
+    assert entry.applicable_tool_names == frozenset({EDIT_TOOL_NAME, MULTI_EDIT_TOOL_NAME})
 
 
 def test_every_hosted_script_path_exists_under_the_hooks_root() -> None:

package/hooks/hooks_constants/transcript_skill_scan_constants.py

@@ -5,3 +5,4 @@ COMPACT_BOUNDARY_SUBTYPE = "compact_boundary"
 SKILL_TOOL_NAME = "Skill"
 TOOL_USE_BLOCK_TYPE = "tool_use"
 USER_ENTRY_TYPE = "user"
+COMMAND_ARGUMENTS_PATTERN = r"<command-args>(.*?)</command-args>"

package/hooks/test_transcript_skill_scan.py

@@ -8,7 +8,11 @@ HOOKS_DIRECTORY = Path(__file__).resolve().parent
 if str(HOOKS_DIRECTORY) not in sys.path:
     sys.path.insert(0, str(HOOKS_DIRECTORY))
 
-from transcript_skill_scan import is_skill_loaded_after_last_compaction, skill_invocation_status
+from transcript_skill_scan import (
+    invokes_skill_with_argument,
+    is_skill_loaded_after_last_compaction,
+    skill_invocation_status,
+)
 
 
 def _skill_entry(name: str) -> str:
@@ -56,3 +60,73 @@ def test_invocation_status_separates_ever_invoked_from_loaded_now() -> None:
     assert skill_invocation_status([_skill_entry("pr-lifecycle")], ("pr-lifecycle",), ()) == (True, True)
     assert skill_invocation_status([_skill_entry("pr-lifecycle"), compaction], ("pr-lifecycle",), ()) == (True, False)
     assert skill_invocation_status([compaction, _skill_entry("other")], ("pr-lifecycle",), ()) == (False, False)
+
+
+BUILD_EVAL_MARKER = "<command-name>/claude-api</command-name>"
+
+
+def _skill_entry_with_arguments(name: str, arguments: object) -> str:
+    return json.dumps(
+        {
+            "type": "assistant",
+            "message": {
+                "content": [{"type": "tool_use", "name": "Skill", "input": {"skill": name, "args": arguments}}]
+            },
+        }
+    )
+
+
+def _invokes_build_eval(lines: list[str]) -> bool:
+    return invokes_skill_with_argument(lines, ("claude-api",), "build-eval", BUILD_EVAL_MARKER)
+
+
+def test_claude_api_skill_with_build_eval_argument_should_count() -> None:
+    assert _invokes_build_eval([_skill_entry_with_arguments("claude-api", "build-eval")])
+
+
+def test_build_eval_argument_followed_by_more_words_should_count() -> None:
+    assert _invokes_build_eval([_skill_entry_with_arguments("claude-api", "build-eval   extra words")])
+
+
+def test_plugin_prefixed_claude_api_with_build_eval_should_count() -> None:
+    assert _invokes_build_eval([_skill_entry_with_arguments("plugin:claude-api", "build-eval")])
+
+
+def test_claude_api_with_another_argument_should_not_count() -> None:
+    assert not _invokes_build_eval([_skill_entry_with_arguments("claude-api", "migrate")])
+    assert not _invokes_build_eval([_skill_entry_with_arguments("claude-api", "migrate build-eval")])
+    assert not _invokes_build_eval([_skill_entry_with_arguments("claude-api", None)])
+    assert not _invokes_build_eval([_skill_entry("claude-api")])
+
+
+def test_build_eval_skill_alone_should_not_count() -> None:
+    assert not _invokes_build_eval([_skill_entry("build-eval")])
+    assert not _invokes_build_eval([_skill_entry_with_arguments("build-eval", "build-eval")])
+
+
+def test_user_claude_api_build_eval_command_should_count() -> None:
+    command_text = BUILD_EVAL_MARKER + "<command-args>build-eval for the gate</command-args>"
+    assert _invokes_build_eval([json.dumps({"type": "user", "message": {"content": command_text}})])
+
+
+def test_user_claude_api_command_with_another_argument_should_not_count() -> None:
+    command_text = BUILD_EVAL_MARKER + "<command-args>migrate</command-args>"
+    assert not _invokes_build_eval([json.dumps({"type": "user", "message": {"content": command_text}})])
+    assert not _invokes_build_eval([json.dumps({"type": "user", "message": {"content": BUILD_EVAL_MARKER}})])
+
+
+def test_quoted_build_eval_command_in_a_tool_result_should_not_count() -> None:
+    command_text = BUILD_EVAL_MARKER + "<command-args>build-eval</command-args>"
+    quoted_result = json.dumps(
+        {"type": "user", "message": {"content": [{"type": "tool_result", "content": command_text}]}}
+    )
+    assert not _invokes_build_eval([quoted_result])
+
+
+def test_build_eval_invocation_before_a_compact_boundary_should_still_count() -> None:
+    lines = [
+        _skill_entry_with_arguments("claude-api", "build-eval"),
+        json.dumps({"type": "system", "subtype": "compact_boundary"}),
+        _skill_entry("other"),
+    ]
+    assert _invokes_build_eval(lines)